fix: clamp UI scroll positions to content bounds

[kkkiio]

Summary

• Derive and expose scroll content bounds during UI layout, then clamp programmatic and input-driven scroll positions to those bounds.
• Upgrade moon_taffy to 0.5.3 for correct container content-size aggregation and add regression coverage for resizing, overflow policy changes, and input deltas.

ScrollPosition was applied directly to child layout without an upper bound, while the previous layout dependency did not provide correct non-leaf content extents. This allowed content to move past its final scroll position and left stale offsets when layout sizes changed. The computed maximum and effective position now give layout, input, and future scrollbar rendering one consistent result.

Fixes #50

Checks

• moon check src/ui -d
• moon test -p Milky2018/selene/ui -d (32 passed)

[Milky2018]

Thanks for the contribution. This was merged with the public surface kept minimal: max_scroll_position remains because interaction code consumes it, while speculative computed fields were not exposed. We also preserved nested border/padding offsets and added a combined scrolling regression. The full core release suite passes (289/289), and the change is available in Selene 0.37.0.